Solved

Connecting a Cisco 3750 to a 3548 XL, and managing it

Posted on 2012-04-02
51
1,158 Views
Last Modified: 2012-08-14
Hello all,

I have trunked over a port from our 3750 switch to a 3548 xl switch.  Everything works fine.  I am using vlans.  the 3548 does not participate in vtp so I just assign the tags at each port without setting up any vlans on the switch itself.
I want to be able to ping and manage the 3548 xl switch.  HOW?!

3750 config
interface GigabitEthernet7/0/48
 description Uplink Trunk
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 200
 switchport mode trunk
 speed 100
 duplex full
 spanning-tree guard root
 ip dhcp snooping trust

3548 config
interface FastEthernet0/48
 description Servers 172.20.0.0/21
 duplex full
 speed 100
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 200
 switchport mode trunk
 spanning-tree rootguard
end

interface VLAN200
 description Servers 172.20.0.0/21
 ip address 172.20.7.253 255.255.248.0
 ip helper-address 172.20.0.21
 ip helper-address 172.20.0.30
 ip directed-broadcast
 no ip route-cache
end

ip-default gateway 172.20.7.254

So.  I know it doesn't work.  Why?

Tom
0
Comment
Question by:thafemann
  • 20
  • 18
  • 11
  • +1
51 Comments
 
LVL 10

Expert Comment

by:mat1458
Comment Utility
Because you have to define the VLANs. You can set the switch to VTP transparent so it does not really intechange VTP information with the other switches. If you want to have VLAN in a Cisco switch you need to configure a bit of VTP. Without VTP - no VLAN.

Issue the "vlan database" command int the 3548XL. Setthe switch to  "vtp transparent". Then you can add all vlan by issuing "vlan 200 name Management_VLAN". At the end say exit. That's it.
0
 
LVL 14

Expert Comment

by:Otto_N
Comment Utility
I see no problem with the config you listed, this should work.  Entering the "interface vlan 200"-command automatically creates the Layer2 VLAN 200 on the switch, so you should not need to create VLAN 200 in the vlan database.  But just to be sure, do a "show vlan" on the 3548, and make sure that vlan 200 exist.  Also, do a "show interface trunk" to ensure that vlan 200 is allowed and active on the trunk link to the 3750.  It might also be a good idea to check the settings on the 3750 as well with the "show interface trunk"-command.  If you can post these outputs (plus a "show ip interface brief" to ensure that Vlan200 is up/up), we can troubleshoot from there.

Note that you do not need to configure "ip helper-address" on interface vlan 200 on the 3548. Fistly, as the IP addresses are within the subnet, a broadcast will reach the destination servers, and, secondly, your interface are not the gateway for the subnet, and the gateway should impliment this function, if required.  But this will not cause your current problem, though.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
Have you defined VLAN 200 on the 3750, and given it an IP address on the VLAN200 interface, in the same subnet as the 3548?
0
 

Author Comment

by:thafemann
Comment Utility
3548 xl
csd-management uptime is 15 hours, 49 minutes
System returned to ROM by reload
System image file is "flash:c3500xl-c3h2s-mz.120-5.WC15.bin"

FastEthernet0/48           unassigned      YES unset  up                    up

1    default                          active    Gi0/1, Gi0/2
200  VLAN0200                         active    Fa0/1, Fa0/2, Fa0/3, Fa0/4,
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8,
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12,
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16,
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20,
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24,
                                                Fa0/25, Fa0/26, Fa0/27, Fa0/28,
                                                Fa0/29, Fa0/30, Fa0/31, Fa0/32,
                                                Fa0/33, Fa0/34, Fa0/35, Fa0/36,
                                                Fa0/37, Fa0/38, Fa0/39, Fa0/40,
                                                Fa0/41, Fa0/42, Fa0/43, Fa0/44,
                                                Fa0/45, Fa0/46, Fa0/47
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active


3750
Port        Mode             Encapsulation  Status        Native vlan
Gi7/0/48    on               802.1q         trunking      200

Yes, vlan 200 is defined on both switches.  However, I did issue the vtp database and set it to transparent mode.

I am sure there is something simple I am missing....

I can plug in any port on the 3548 and it is in the vlan 200 and they work just fine.  I am trying to manage the 3548xl, and I am kicking myself that I don't see it.

Now, I am using the regular ports and not the gbic ports.  I remember something a while ago about that.

TIA

Tom
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
can you do a show ip int brief on the 3750?
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
vtp transparent is fine, it effectively turns off vtp, which I always recommend. If you plug in to a port on the 3750, do you obtain an IP address from a DHCP server, and is it correct?
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
I assume if you do a show vlan on the 3750 it shows something similiar to the 3548xl?
I noticed you're on gi7/48 on the 3750, so that makes this a stack of 3750 switches; you can alwys try a "no shut" on the interface to reset it.
Does show cdp neighbour indicate the switches can see each other?
0
 

Author Comment

by:thafemann
Comment Utility
sh ip int bri  (3750)
Vlan1                  unassigned      YES NVRAM  up                    up
Vlan200                172.20.7.254    YES NVRAM  up                    up
Vlan201                172.20.15.254   YES NVRAM  up                    up
Vlan202                172.20.23.254   YES NVRAM  up                    up

Yes, I can plug a device into the 3750 and the 3548 xl and they both get IP addresses from a dhcp server and work fine.
The 3750 was in place and working fine.  I am adding the 3548xl to the mix for some server management ports.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
Can the 3750 ping the 3548?
0
 
LVL 10

Expert Comment

by:mat1458
Comment Utility
Please send show run, show vlan and show spanning-tree vlan 200 of both switches. Then we probably can see easily what needs to be done.
0
 

Author Comment

by:thafemann
Comment Utility
Here they are....PVST  I am running MST on the 3750 because I thought it was cool to play with a while ago....
3548xl.TXT
3750.TXT
0
 

Author Comment

by:thafemann
Comment Utility
No, neither the 3750 or the 3548 can ping each other.

Yes, on the 3750 I am on port gi7/0/48.  It is a "regular" port and a part of a stack with a total of 8 switches in the stack.

On the 3548, I am on port fa0/48.

I have the ports statically set for speed and duplex and am using a crossover.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
Are you running MST on the 3548?
0
 

Author Comment

by:thafemann
Comment Utility
Didn't turn anything on, on the 3548
Didn't think I had to.
Tom
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
As you're only supporting VLAN 200 on the 3548, don't bother with trunking at all, just set the port on the 3750 and the 3548 to switch access vlan 200, no switch mode trunk, no shut.
There's no need for a trunk port if you're only passing 1 VLAN.
By default the 3548 will run PVST, it may cause an issue but I can't say for certain. I do know I've had problems with cisco switches running MSTP with other third party switches, and the 3548 is an old switch and may have a similiar problem.
0
 

Author Comment

by:thafemann
Comment Utility
3750 config (new)

interface GigabitEthernet7/0/48
 description Management Ports vlan 200
 switchport access vlan 200
 switchport mode access
 spanning-tree portfast
end

3548xl
interface FastEthernet0/48
 description Management Ports vlan 200
 switchport access vlan 200
 spanning-tree portfast

interface VLAN200
 description CHS Servers 172.20.0.0/21
 ip address 172.20.7.253 255.255.248.0
 ip directed-broadcast
 no ip route-cache
!
ip default-gateway 172.20.7.254

Still, can not manage or ping.....
0
 
LVL 14

Expert Comment

by:Otto_N
Comment Utility
If you can see any server plugged into the 3548 on VLAN200, it should not be a Spanning-tree issue.  Just confirm that the interface Vlan200 on the 3548 is "up/up" (sh ip int brief).
0
 
LVL 10

Assisted Solution

by:mat1458
mat1458 earned 311 total points
Comment Utility
You have a state of spanning-tree root inconsistent on FA0/48 of your 3548. This is because the 3548 has the default root priority of 32768 and you have set the 3750 as root bridge for the vlan 200 with priority 24576.

Now with the command spanning-tree rootguard on fa0/48 you advise your switch not to trust any Root-BPDU and to bring that port down. Remove the command and shut/no shut the interface and you should be fine.
0
 

Author Comment

by:thafemann
Comment Utility
VLAN200 is up, line protocol is up
  Internet address is 172.20.7.253/21
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is enabled
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is disabled
  IP fast switching on the same interface is disabled
  IP Null turbo vector
  IP multicast fast switching is disabled
  IP multicast distributed fast switching is disabled
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
0
 

Author Comment

by:thafemann
Comment Utility
Well, the MST 1 setting is priority 24576, and vlan 200 is in MST 1, so I think it should be fine.
Yes?
0
 
LVL 5

Assisted Solution

by:Gareth Tomlinson CISSP
Gareth Tomlinson CISSP earned 189 total points
Comment Utility
the rootguard command on the port is the issue, Tom, you should remove it.
0
 

Author Comment

by:thafemann
Comment Utility
So...go back to a trunked port and just remove the rootguard command.  Because this is the config right now....

interface GigabitEthernet7/0/48
 description Management Ports vlan 200
 switchport access vlan 200
 switchport mode access
 spanning-tree portfast
end

3548xl
interface FastEthernet0/48
 description Management Ports vlan 200
 switchport access vlan 200
 spanning-tree portfast

interface VLAN200
 description CHS Servers 172.20.0.0/21
 ip address 172.20.7.253 255.255.248.0
 ip directed-broadcast
 no ip route-cache
!
ip default-gateway 172.20.7.254
0
 
LVL 10

Assisted Solution

by:mat1458
mat1458 earned 311 total points
Comment Utility
Rootguard means that whenever that switch receives a BPDU with a lower root priority on the port with the command it blocks the port. The command is there to make sure that no rougue bridges can harm the root bridge. In your case it would have made sense on the 3750 but not on the 3548.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
leave it as is, you don't need a trunk at all, Tom.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
if that is the config right now, everything should be working. What did show cdp neightbour return with?
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 

Author Comment

by:thafemann
Comment Utility
okay...no trunk.  config as an access port on both 3750 and 3548.  configs as follows....no ping to 172.20.0.7.253 and can not manage the 3548 via telnet.  Only console cable.  each of the switches can ping their address, neither can ping each other.  The 3548 can not ping its gateway.

3750
Interface GigabitEthernet7/0/48
 description Management Ports vlan 200
 switchport access vlan 200
 switchport mode access
 spanning-tree portfast
end

3548xl
interface FastEthernet0/48
 description Management Ports vlan 200
 switchport access vlan 200
 spanning-tree portfast

interface VLAN200
 description CHS Servers 172.20.0.0/21
 ip address 172.20.7.253 255.255.248.0
 ip directed-broadcast
 no ip route-cache
!
ip default-gateway 172.20.7.254

shut and no shut on each.
0
 
LVL 10

Expert Comment

by:mat1458
Comment Utility
Please repeat the show spanning-tree vlan command for both switches and post it.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
show int command on both switches, please, for the appropriate ports?
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
Er.. you have done a "no shut" on the int vlan200 on the 3548XL, right? and configured a username and password, allowed login to vty 0 4? I am just checking, because I can't see at the moment why it isn't working!
0
 

Author Comment

by:thafemann
Comment Utility
makes sense that MST does not work on 3548....

is there a compatibility mode of sorts?
3548xl-sh-span-vlan-200.TXT
3750-sh-span-vlan-200.TXT
0
 

Author Comment

by:thafemann
Comment Utility
Hashernite,
vty doesn't work on the 3548 because I can not get to it by any means except console.  This is kinda what I am trying to solve.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
You haven't got all the 3750 ports, Tom; also in the 3548, the port fa0/48 is showing as down?
0
 
LVL 10

Assisted Solution

by:mat1458
mat1458 earned 311 total points
Comment Utility
Can you repeat the show vlan on 3548? All your interfaces are down int VLAN 200.
0
 

Author Comment

by:thafemann
Comment Utility
Mat1458,

Yes all interfaces are down...nothing connected to it yet.  I think the big thing to see is

3548xl
Spanning tree 200 is executing the IEEE compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, address 0007.0e8d.3481
  Configured hello time 2, max age 20, forward delay 15
  We are the root of the spanning tree                                         <---------THIS RIGHT HERE!
  Topology change flag not set, detected flag not set, changes 0
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 1, topology change 0, notification 0
0
 

Author Comment

by:thafemann
Comment Utility
1    default                          active    Gi0/1, Gi0/2
200  VLAN0200                         active    Fa0/1, Fa0/2, Fa0/3, Fa0/4,
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12,
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16,
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20,
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24,
                                                Fa0/25, Fa0/26, Fa0/27, Fa0/28,
                                                Fa0/29, Fa0/30, Fa0/31, Fa0/32,
                                                Fa0/33, Fa0/34, Fa0/35, Fa0/36,
                                                Fa0/37, Fa0/38, Fa0/39, Fa0/40,
                                                Fa0/41, Fa0/42, Fa0/43, Fa0/44,
                                                Fa0/45, Fa0/46, Fa0/47, Fa0/48
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active
0
 
LVL 10

Assisted Solution

by:mat1458
mat1458 earned 311 total points
Comment Utility
Did you unplug the link to the 3750? That one's down as well for VLAN 200 so it is logical that your switch is the root. It is alone in the world. Please have a look at the VLAN database with the show vlan command.
0
 
LVL 10

Expert Comment

by:mat1458
Comment Utility
Sorry for asking again, you were faster.
0
 
LVL 10

Assisted Solution

by:mat1458
mat1458 earned 311 total points
Comment Utility
Now this is weird, can you repeat the show spanning-tree vlan conmmand once again to see if the interfaces are still considered to be down? Because the show vlan command now tells us that everything is up and that you should be fine.
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
as everything is now in vlan 200, can you try a different interface on the 3548 to connect to the 3750? Just to rule out a hardware problem
0
 
LVL 10

Expert Comment

by:mat1458
Comment Utility
Sorry, have to go now. Be back in two hours.
0
 

Author Comment

by:thafemann
Comment Utility
Okay...with these settings, the ports shut themselves off...
3750
Interface GigabitEthernet7/0/48
 description Management Ports vlan 200
 switchport access vlan 200
 switchport mode access
 spanning-tree portfast
end

3548xl
interface FastEthernet0/48
 description Management Ports vlan 200
 switchport access vlan 200
 spanning-tree portfast

interface VLAN200
 description CHS Servers 172.20.0.0/21
 ip address 172.20.7.253 255.255.248.0
 ip directed-broadcast
 no ip route-cache
!
ip default-gateway 172.20.7.254
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
so you connect them, and they automatically shut down, right?
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
set spped and duplex at both ends, please
0
 
LVL 5

Accepted Solution

by:
Gareth Tomlinson CISSP earned 189 total points
Comment Utility
I'm wondering if spanning-tree portfast is causing the problem, as there are 2 different versions running.
Turn it off on the 3548, in fact try disabling spanning tree altogether on the 3548.
Can you also run a "show logg" command and see if there is a reason for the interface shut down on both switches.
0
 

Author Comment

by:thafemann
Comment Utility
Speed 100 and duplex full

as soon as I "no spanning-tree portfast" the links came up.....but....did I shoot myself in the foot?  I can ping across the routers...not feeling too good about who is the root!

Tom
0
 
LVL 5

Assisted Solution

by:Gareth Tomlinson CISSP
Gareth Tomlinson CISSP earned 189 total points
Comment Utility
I think it is only because of the incompatible spanning tree types, Tom, it's certainly a new one on me and I'll remember it.
As I said earlier, I've seen this with Cisco and 3rd party switches, and the 3548 is a VERY old switch.
Just so long as you make sure no loops are plugged in you'll be OK as you are, root is pretty irrelevant if there's only 1 physical connection to another switch.
Gareth
0
 

Author Comment

by:thafemann
Comment Utility
Hum....

I think I got it..

on the3548xl....."spanning-tree vlan 200 priority 65535"

So this is what it looks like....now...

3548xl
interface FastEthernet0/48
 description Management Ports vlan 200
 duplex full
 speed 100
 switchport access vlan 200
end
interface VLAN200
 description CHS Servers 172.20.0.0/21
 ip address 172.20.7.253 255.255.248.0
 ip directed-broadcast
 no ip route-cache
end

3750
interface GigabitEthernet7/0/48
 description Management Ports vlan 200
 switchport access vlan 200
 switchport mode access
 speed 100
 duplex full
end

maybe right?
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
looks good to me, everything working OK now, DHCP and all?
0
 

Author Comment

by:thafemann
Comment Utility
Onto another question....lets say I do want to trunk these ports.  can I?  And what if I want to Etherchannel them for more bandwidth, can I?
0
 
LVL 5

Expert Comment

by:Gareth Tomlinson CISSP
Comment Utility
yes, you can - it's only the spanning tree that was causing the issue.
On the other hand, bearing in mind that spanning tree is bound in to multiple VLANs, I'd seriously look at replacing the 3548 with something more modern before I did that.
0
 
LVL 10

Expert Comment

by:mat1458
Comment Utility
Looking a bit closer at your 3750 configuration I also see some more stuff that makes it a bit complicated:
You have switched off the console messages so you do not see any error messages unless you look them up in the log. In my opinion you should enable them with "logging console".

You then would have seen the next problem easily that was caused by the "spanning-tree portfast bpduguard default" command which tells the switch to shut down any port on which it receives a BPDU. This feature is ok on user ports but as we have started to change your configuration from a trunk to a userport with spanning-tree portfast it did what it had to do. By removing portfast from the interface you cleared the situation, you could have done a "spanning-tree bpduguard disable" command on the interface as well.

Go back to trunk, even configure EtherChannel, that's all possible (for the EtherChannel you would need spanning-tree). The MST vs. traditional spanning tree thing is still an issue: they are compatible, however it is not favorable to have mixtures of very old and slightly newer protocols. With the 3500XL you'll never get to MST so it will always slow down your convergence or add potential risk to your network if you switch off spanning tree to that device. In my opinion you should get a newer model that fits into your whole environment and supports MST.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now